Forum Discussion

divyatulluri's avatar
divyatulluri
Regular Visitor
7 years ago

Data filtration in SAP HANA data source with Power BI without RLS implementation at Power BI end

We are using MS Power BI (PBI hereafter) for creating analytical reports on top of SAP HANA. The reports are created in PBI desktop, connecting to HANA using SAP HANA client packages, and then exported to the PBI cloud service which uses on-premise PBI gateway to connect to HANA system. Users log-in to PBI cloud using Office 365 account (usually email id) and regardless of the individual user, the PBI gateway uses the stored credential (connection user) to connect and query data from HANA. This all works well.

We want to perform row-level data authorization control in HANA for these PBI queries that are received via PBI gateway (or ODBC drivers, for test purpose) using dynamic SQL analytic privileges. However, the SESSION_USER in the stored procedure always returns the connection user details and not the actual user who is performing the query. Without the actual user details, we cannot filter data dynamically based on authorizations assigned to him.

Please suggest me the best approach or solution for third-party BI clients scenarios, in general, and how to resolve the current problem with PBI service and desktop connection.

Need Help

1 Reply

  • v-juanli-msft's avatar
    v-juanli-msft
    Icon for Community Support rankCommunity Support
    7 years ago

    Hi divyatulluri

    It seems that the SAP HANA conenction cannot utilise any row level secutiry already implemented in HANA but you can build a seperate secuirty model in Power BI.

     

    After connecting to SAP HANA database in Power BI Desktop, you can define roles and rules to implement row level security for your dataset, and you will need to add members to defined roles in Service after publishing the Power BI Desktop file. 

    Moreover, you can take advantage of the DAX function username() within your dataset. You can use it within expressions in Power BI Desktop. When you publish your model, it will be used within the Power BI service. You can take a look at the following article to get more details about row level security in Power BI: https://powerbi.microsoft.com/en-us/documentation/powerbi-admin-rls/.

     

    In addition, the article you reviewed is specific to SSAS data source, I am afraid that you are not able to use same technology to map user with SAP HANA.

    Additionally, here are article about creating dynamic row level security in power bi

    http://www.sensdat.com/publications/power-bi-row-level-security-pattern/

    http://radacad.com/dynamic-row-level-security-with-manager-level-access-in-power-bi

     

    Best Regards

    Maggie